Chartnote Privacy Policy

Version 2.0 — Posted September 6, 2026 — Effective September 16, 2026

Supersedes the Privacy Policy effective January 19, 2021

1.Introduction

This Privacy Policy describes how Chartnote, Inc., a Delaware corporation (“Chartnote,” “we,” “us,” or “our”), collects, uses, safeguards, and discloses information in connection with our websites, including https://chartnote.com, our web and mobile applications, our browser extensions, and the related services we provide (collectively, the “Services”).

This Privacy Policy is part of a family of documents that together govern your use of the Services: the Chartnote Terms of Use (chartnote.com/termsOfUse), the Chartnote Master Subscription Agreement where applicable (chartnote.com/msa) (the “MSA”), the Chartnote Business Associate Agreement (chartnote.com/baa) (the “BAA”), and the Chartnote Fair Use & Account Policy (chartnote.com/fairUse). If there is a conflict between this Privacy Policy and the BAA with respect to Protected Health Information, the BAA governs.

By using the Services, you acknowledge this Privacy Policy. Capitalized terms not defined here have the meanings given in the Terms of Use.

2.The Two Kinds of Information We Handle, and Our Role for Each

Chartnote handles two fundamentally different categories of information, and our legal role differs for each. Understanding this distinction is the key to understanding this Policy.

Account and Usage Data

Information about you as a user of the Services — such as your name, email address, professional details, subscription and billing records, device and log data, and support communications. For this category, Chartnote determines the purposes and means of processing and acts as a data controller (or “business” under California law). Sections 4, 6, and 8–15 of this Policy primarily address this category.

Customer Content, including Protected Health Information (PHI)

The clinical content you create, upload, record, or generate using the Services — including audio recordings, transcripts, notes, templates, and any patient information they contain. For this category, Chartnote acts as a service provider processing content on behalf of and at the direction of the account holder: as a HIPAA business associate under the BAA where the account holder is a covered entity or its workforce, and as a data processor under applicable data protection law. Chartnote does not determine how Customer Content is used in clinical care; the clinician or organization that holds the account does. Section 5 of this Policy addresses this category, and the BAA is the controlling document for PHI.

3.Definitions

Services means the Chartnote websites, web and mobile applications, browser extensions, and related services operated by Chartnote, Inc.

Personal Data means information relating to an identified or identifiable natural person.

Account Data means Personal Data you provide to create and maintain your account and subscription.

Usage Data means information collected automatically from your use of the Services or from the Services infrastructure itself.

Customer Content means content created, uploaded, recorded, or generated by or for an account holder using the Services, including audio, transcripts, clinical notes, and templates.

Protected Health Information or PHI has the meaning given in HIPAA (45 C.F.R. § 160.103) and, for purposes of this Policy, refers to PHI contained in Customer Content.

BAA means the Chartnote Business Associate Agreement applicable to the account (self-serve or enterprise edition), available at chartnote.com/baa.

4.Information We Collect

Account Data

When you register or subscribe, we collect information such as your first and last name, email address, professional role or specialty, organization or team affiliation, and preferences. If you subscribe to a paid plan, our payment processors collect payment information as described in Section 10; Chartnote does not store your full payment card details.

Usage Data

We automatically collect technical information generated by your use of the Services, such as IP address, browser type and version, device type and identifiers, operating system, pages visited, features used, timestamps, session duration, and diagnostic data. We use Usage Data for security, service operation, capacity planning, administration of the Fair Use & Account Policy, and product improvement.

Support and Communications Data

When you contact support or communicate with us, we collect the contents of those communications and associated metadata.

Cookies and Similar Technologies

The Chartnote application uses essential cookies required for session management, authentication, security, and remembering your preferences. The application does not use advertising cookies. Our public marketing website may use analytics and, where enabled, advertising and remarketing technologies as described in Section 14. You can configure your browser to refuse cookies, though essential cookies are required for the application to function.

5.Customer Content and Protected Health Information

Customer Content exists in the Services so that clinicians can document care. We process it only to provide the Services to the account holder and as permitted by the BAA and applicable law. Specifically:

The BAA governs. Where Customer Content contains PHI, our creation, receipt, maintenance, transmission, use, and disclosure of that PHI are governed by the BAA and HIPAA. The BAA controls over this Policy for PHI.
The account holder directs. Customer Content belongs to and is controlled through the account under which it was created. Team and enterprise workspaces provide administrative controls over content created under organization-managed seats; individual accounts are controlled by the individual account holder.
The EHR remains the system of record. Chartnote is a documentation tool, not an electronic health record; the electronic health record into which notes are transferred remains the legal medical record and source of truth.
No advertising use. We do not use Customer Content or PHI for advertising, and we do not sell or share it for cross-context behavioral advertising.
No AI training on Customer Content. We do not use Customer Content to train artificial intelligence models, and we contractually require the same of the AI service providers that process Customer Content on our behalf, as described in Section 7.
Configurable retention. Retention and auto-delete settings for notes and audio are configurable at the account or workspace level, as described in Section 9 and in product documentation.
Authorized use is the account holder’s responsibility. As set out in the Terms of Use, clinicians who use the Services in connection with a healthcare facility, employer, or other organization are responsible for ensuring that their use is authorized by, and consistent with the policies of, that organization, and for obtaining all patient consents required by law. Chartnote does not verify, and is not responsible for verifying, whether an account holder’s facility or employer has authorized their use of the Services.

6.How We Use Information

We use Account Data, Usage Data, and Support and Communications Data to:

provide, maintain, secure, and improve the Services;
create and administer your account, subscription, billing, and renewals;
provide customer support and respond to your requests;
monitor usage, detect and prevent fraud, abuse, account sharing inconsistent with the Fair Use & Account Policy, and security incidents;
comply with legal obligations and enforce our agreements;
send service notices, and — with the ability to opt out at any time — newsletters and information about Chartnote products and features; and
fulfill any other purpose disclosed to you at collection or undertaken with your consent.

We use Customer Content solely to provide the Services as described in Section 5 and the BAA.

7.Artificial Intelligence Processing

The Services include artificial intelligence features such as ambient AI scribe, dictation, clinical documentation assistance, coding suggestions, and a clinical reference copilot. Our commitments for AI processing are:

Customer Content submitted to AI features is processed to generate output for the requesting clinician and is not used to train Chartnote’s or any third party’s AI models.
AI service providers that process Customer Content on our behalf are bound by business associate agreements and, where offered, zero-data-retention configurations, so that Customer Content is not retained by those providers beyond what is required to return a result.
AI features are clinician-initiated and human-in-the-loop: the clinician reviews, edits, and approves all AI-generated documentation before clinical use, as set out in the Terms of Use. Chartnote’s AI does not make automated decisions about patients.
A current description of our AI practices and subprocessors is available through the Chartnote Trust Center at trust.chartnote.com.

8.Disclosure of Information

We disclose information only as described below.

8.1 Service Providers and Subprocessors. We use vetted third-party providers (for example, cloud hosting, speech-to-text, AI processing, payment, analytics, customer support, and communications providers) to operate the Services. Providers may access information only to perform services on our behalf, are bound by confidentiality obligations, and — where they handle PHI — by business associate agreements. A current subprocessor list is available through the Trust Center at trust.chartnote.com.

8.2 Legal Requirements. We may disclose information if required to do so by law or in response to valid, binding requests by public authorities or courts of competent jurisdiction (for example, a subpoena, court order, or warrant). We review each request for validity and scope, disclose only what we are legally required to disclose, and, where lawful and practicable, notify the affected account holder before disclosure.

8.3 Requests by Third Parties, Including Employers. We do not release the contents of an individual account — including Customer Content — to any third party, including a current or former employer, practice, or other organization, absent (i) the written authorization of the account holder, (ii) valid legal process as described in Section 8.2, or (iii) with respect to organization-managed seats in a team or enterprise workspace, the administrative rights of the organization that is the customer of record for that workspace. Contractual arrangements between an account holder and a third party to which Chartnote is not a party do not, by themselves, authorize disclosure. Formal requests should be directed to privacy@chartnote.com.

8.4 Business Transfers. If Chartnote is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy and, for PHI, the BAA and HIPAA.

8.5 Protection of Rights and Safety. We may disclose Account Data and Usage Data where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Chartnote, our customers, or others, including to enforce our agreements and the Fair Use & Account Policy. Disclosure of PHI under this Section is made only as permitted by the BAA and HIPAA.

8.6 With Your Consent. We may disclose information for any other purpose with your consent.

8.7 No Sale of Personal Data. We do not sell Personal Data, and we do not sell or share Personal Data for cross-context behavioral advertising as those terms are defined under California law.

9.Data Retention

We retain Account Data for as long as your account is active and thereafter as necessary to comply with legal obligations (including HIPAA documentation retention requirements applicable to our records), resolve disputes, and enforce our agreements. Usage Data is generally retained for shorter periods except where needed for security or legal compliance.

Customer Content is retained according to the retention and auto-delete settings applicable to the account or workspace, and otherwise in accordance with the BAA, which governs return or destruction of PHI upon termination. Audio recordings are subject to the retention window configured for the account.

10.Security

Chartnote maintains an information security program aligned with SOC 2 and undergoes annual SOC 2 Type II examination. Safeguards include encryption of data in transit and at rest, multi-factor authentication, role-based and least-privilege access controls, audit logging of record access, managed endpoints for workforce devices, vendor security review, and an incident response program with a designated privacy officer. Security documentation, including our SOC 2 report, is available under NDA through the Trust Center at trust.chartnote.com.

Payment processing is handled by PCI-DSS-compliant processors (Stripe, Apple, and Google, as applicable to your purchase channel); Chartnote does not store full payment card numbers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security; we commit to safeguards that are reasonable and appropriate to the sensitivity of the information we handle.

11.Where Information Is Stored; International Access

The Services are hosted in Amazon Web Services regions located in the United States, and production data, including Customer Content, is stored exclusively in the United States. Members of our workforce located outside the United States may access systems for engineering and support purposes under multi-factor authentication, least-privilege access, managed devices, and audit logging.

If you use the Services from outside the United States, we may store and process your Personal Data outside your country of residence, including outside the European Union (EU), the United Kingdom (UK), Canada, and Australia. When transferring Personal Data internationally, we protect it by implementing appropriate safeguards, such as:

Standard Contractual Clauses (SCCs): for transfers from the EU and UK, we use European Commission-approved (and, for the UK, the applicable UK addendum or International Data Transfer Agreement) contractual obligations to safeguard your Personal Data;
Adequacy decisions: where applicable, we rely on adequacy decisions of the European Commission or the UK government for countries deemed to provide adequate protection;
Contractual protection: for transfers from Canada and Australia, we ensure through contractual and other means that Personal Data receives a comparable level of protection while outside those countries, consistent with PIPEDA and the Australian Privacy Principles; and
Additional measures: where required, we adopt supplementary security and technical measures — including the encryption, access-control, and audit safeguards described in Section 10 — to ensure your Personal Data remains secure.

We will enter into a data processing agreement, including SCCs where applicable, with customers that require one. By providing us with your Personal Data or using the Services, you acknowledge that your Personal Data may be transferred to and stored in the United States, where it is subject to U.S. law. If you have concerns or questions about our data transfer practices, please contact us at privacy@chartnote.com.

12.Your Rights and Choices

Subject to applicable law, you may:

access the Personal Data we hold about you and receive a copy of your Account Data and, for individual accounts, an export of your Customer Content in a structured, commonly used format;
correct inaccurate or incomplete Personal Data;
request deletion of your Personal Data and account, subject to retention required by law, the BAA, and our legal agreements;
object to or request restriction of certain processing;
withdraw consent where processing is based on consent; and
opt out of marketing communications at any time using the unsubscribe link or by contacting us.

We may need to verify your identity before acting on a request, and requests concerning Customer Content in organization-managed workspaces may be directed to the organization that administers the workspace. To exercise these rights, contact us as described in Section 18.

If your Personal Data appears within Customer Content as a patient of a clinician who uses Chartnote, please direct requests to your healthcare provider; Chartnote processes that information on the provider’s behalf and will support the provider in responding as required by the BAA and HIPAA.

13.International Users: European Economic Area, United Kingdom, Canada, and Australia

If you are in the EEA or the UK, Chartnote is the controller of your Account Data and Usage Data, and processes them on the following legal bases: performance of a contract (providing the Services), legitimate interests (security, fraud prevention, and product improvement), compliance with legal obligations, and consent (marketing communications). Chartnote acts as a processor with respect to Customer Content. You have the rights described in Section 12 and the right to lodge a complaint with your supervisory authority.

If you are in Canada, we handle Personal Data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial private-sector privacy laws, including the principles of accountability, identified purposes, consent, limiting collection, use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. As described in Section 11, the Services are hosted in the United States, and Personal Data you provide is transferred to and processed there, where it is subject to U.S. law; we protect it while outside Canada through the contractual and security safeguards described in Section 11, and where a customer agreement requires that Customer Content remain in Canada, the applicable arrangements are set out in that agreement. Personal health information contained in Customer Content is processed on behalf of the custodian clinician or organization, whose obligations under provincial health-information laws remain their own. You may access or correct your Personal Data, withdraw consent (subject to legal and contractual restrictions), or raise a concern with our Privacy Officer using the contact information in Section 18, and you may also contact the Office of the Privacy Commissioner of Canada.

If you are in Australia, we handle Personal Data consistently with the Australian Privacy Principles under the Privacy Act 1988 (Cth), including open and transparent management, collection only for the purposes described in this Policy, security safeguards, and rights of access and correction. Chartnote is an overseas recipient of information you provide: as described in Section 11, the Services are hosted in the United States, and we protect your Personal Data there through the contractual and security safeguards described in Sections 10 and 11. Health information contained in Customer Content is handled on behalf of the treating clinician or organization; clinicians using the Services in Australia are responsible for the collection, consent, and cross-border disclosure obligations that apply to them as health service providers. We maintain a data breach response program and will notify affected customers of eligible data breaches so that they can meet their own obligations under the Notifiable Data Breaches scheme. You may access or correct your Personal Data or raise a complaint with our Privacy Officer using the contact information in Section 18, and you may also contact the Office of the Australian Information Commissioner.

14.California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the rights to know, access, correct, delete, and port your Personal Data, to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights. The categories of Personal Data we collect, the purposes of collection, and the categories of recipients are described in Sections 4, 6, and 8.

We have never sold Personal Data, and we have not sold or shared Personal Data in the preceding twelve months (the disclosure period required under California law). We do not share Personal Data for cross-context behavioral advertising from within the application. Our public marketing website may use analytics and advertising technologies (such as Google Analytics and advertising-platform remarketing tags) that involve the collection of identifiers by those providers; you can opt out through the cookie controls on the website, through the opt-out mechanisms those providers offer, and by using a browser that sends a Global Privacy Control signal.

Personal Data that is PHI governed by HIPAA is exempt from the CCPA/CPRA and is protected under the BAA and HIPAA instead.

15.Do Not Track and Global Privacy Control

Where required by law, we honor recognized opt-out preference signals such as Global Privacy Control on our marketing website. The application itself does not use advertising or cross-site tracking technologies.

16.Children

The Services are intended for use by licensed healthcare professionals and their organizations, and are not directed to children. We do not knowingly collect Account Data from anyone under 18, and we will delete such data if we become aware of it. Customer Content may lawfully include information about patients of any age, including minors; that information is PHI processed on behalf of the treating clinician or organization under the BAA.

17.Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a new version number and effective date and, for material changes, provide at least ten (10) days’ advance notice by email and/or prominent notice within the Services before the change becomes effective — consistent with the amendment mechanics of the Terms of Use (Section 29) and the MSA (Section 10.10). Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

18.Contact Us

Privacy questions, requests to exercise your rights, and formal legal requests should be directed to:

Chartnote, Inc., 2062 John Jones Rd, Ste 130, Davis, CA 95616

Attn: Privacy Officer — Gerardo Guerra Bonilla, MD

Email: privacy@chartnote.com

Trust Center: trust.chartnote.com

General support inquiries: help@chartnote.com

Version History

Version 2.0 (September 2026): complete restatement of the January 2021 Policy. Distinguishes Account and Usage Data (Chartnote as controller) from Customer Content and PHI (Chartnote as business associate/processor under the BAA); adds AI processing commitments (no training on Customer Content; zero-data-retention providers under BAA); states the position on third-party and employer requests (Section 8.3); removes advertising and remarketing cookies from the application; adds Canada (PIPEDA) and Australia (Privacy Act 1988) disclosures; documents SOC 2 Type II security posture and U.S.-only data residency; adds the ten-day amendment notice; designates privacy@chartnote.com as the privacy and legal intake; updates the entity to Chartnote, Inc., a Delaware corporation.